eQuickSQLXSS.txt

------------------------------------------------------ Nightmare TeAmZ Advisory 016 ------------------------------------------------------ Date - 11/2005 e-Quick Cart Sql & Xss AFFECTED PRODUCTS ================= e-Quick Cart http://www.cdmweb.com Xss Poof: ========...

CVE-2005-3685

Cross-site scripting XSS vulnerability in shopadmin.asp in VP-ASP Shopping Cart 5.50 allows remote attackers to inject arbitrary web script or HTML via the UserName parameter...

CVE-2005-3685

CVE-2005-3685 describes a cross-site scripting (XSS) vulnerability in VP-ASP Shopping Cart 5.50, exploitable via the UserName parameter in shopadmin.asp. The vulnerability can allow remote attackers to inject arbitrary web script or HTML. According to connected sources, the impact is limited to p...

CVE-2005-3685

Cross-site scripting XSS vulnerability in shopadmin.asp in VP-ASP Shopping Cart 5.50 allows remote attackers to inject arbitrary web script or HTML via the UserName parameter...

[SA17602] VP-ASP Shopping Cart "UserName" Cross-Site Scripting Vulnerability

TITLE: VP-ASP Shopping Cart "UserName" Cross-Site Scripting Vulnerability SECUNIA ADVISORY ID: SA17602 VERIFY ADVISORY: http://secunia.com/advisories/17602/ CRITICAL: Less critical IMPACT: Cross Site Scripting WHERE: From remote SOFTWARE: VP-ASP Shopping Cart 5.x http://secunia.com/product/1832/...

Comersus Cart Cross-Site Scripting Vulnerability

The malicious user is able to compromise the parameters to invoke a Cross-Site Scripting attack. This can be used to take advantage of the trust between a client and server allowing the malicious user to execute malicious JavaScript on the client's machine or perform a denial of service shutting...

Shopping Cart Arbitrary Command Execution (Hassan)

We detected the presence of the Shopping Cart CGI Hassan. A security problem in this CGI allows execution of arbitrary commands. SPDX-FileCopyrightText: 2001 SecuriTeam Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Carello.dll <= 1.3 Command Execution Vulnerability

Carello.dll was found on the remote web server. SPDX-FileCopyrightText: 2003 Michel Arboi Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cart32 GetLatestBuilds XSS

The remote host is using Cart32, a shopping cart software. There is a bug in this software which makes it vulnerable to cross site scripting attacks. SPDX-FileCopyrightText: 2004 Noam Rathaus Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respectiv...

PDGSoft Shopping cart vulnerability

The executables SPDX-FileCopyrightText: 2003 John Lampe Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.11723";...

Comersus BackOffice Lite Administrative Bypass

Comersus ASP shopping cart is a set of ASP scripts creating an online shoppingcart. It works on a database of your own choosing, default is msaccess, and includes online administration tools. SPDX-FileCopyrightText: 2005 Noam Rathaus Some text descriptions might be excerpted from a referenced...

Comersus Cart /comersus/database/comersus.mdb Direct Request Datbase Disclosure

The remote host appears to be running Comersus Cart, an ASP shopping cart application. The version of Comersus Cart installed on the remote host fails to restrict access to its customer database, which contains order information, passwords, credit card numbers, etc. Further, the data in all...

Comersus BackOffice comersus_backoffice_menu.asp Multiple Parameter SQL Injection

The remote host appears to be running Comersus Cart, an ASP shopping cart application. The version of Comersus Cart installed on the remote host fails to sanitize input to the 'adminName' and 'adminpassword' fields of the 'backofficeLite/comersusbackofficemenu.asp' script before using them in a...

midicartInject.txt

Hello All, I have discovered a number of remote vulnerabilities in: MidiCart ASP Shopping Cart, Evaluation Version 7 & Standard & Pro Authors Site: http://www.midicart.com/ +-Examples:--------------------------------------------------+ 1------------------------------------------------------------...

CVE-2004-2448

S-Mart Shopping Cart or RediCart 3.9.5b stores smart.cfg under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as the database name...

CVE-2004-2448

Technical details about CVE-2004-2448 are not publicly available in the provided connected documents. The initial entry describes an access-control weakness in smart.cfg but no additional product/version/exploit data is supplied here. Monitor for updates.

CVE-2005-2623

ECW-Shop 6.0.2 is affected. A remote attacker can specify a negative quantity for an item, causing the item price to be subtracted from the cart total, which impacts cart integrity. The NVD entry notes a base score of 5.0 (Medium) with the impact on integrity as PARTIAL and no confidentiality or ...

CVE-2005-2623

ECW-Shop 6.0.2 allows remote attackers to reduce the total cost of their shopping cart by specifying a negative quantity for an item, which causes the price of the item to be subtracted from the total cost...

CVE-2005-2623

ECW-Shop 6.0.2 allows remote attackers to reduce the total cost of their shopping cart by specifying a negative quantity for an item, which causes the price of the item to be subtracted from the total cost...

CVE-2004-2412

CVE-2004-2412 involves VP-ASP Shopping Cart 4.0–5.0 with SQL injection vulnerabilities in the catalogid parameter of the two endpoints, shopreviewlist.asp and shopreviewadd.asp . The vulnerability enables remote attackers to execute arbitrary SQL commands against the underlying database, as state...